Changeset 50443 in webkit for trunk/JavaScriptCore/jit/JITStubs.cpp

Timestamp:

Nov 2, 2009, 10:49:42 PM (16 years ago)

Author:

[email protected]

Message:

REGRESSION (r48573): JSC may incorrectly cache chain lookups with a dictionary at the head of the chain
​https://bugs.webkit.org/show_bug.cgi?id=31045

Reviewed by Gavin Barraclough.

Add guards to prevent caching of prototype chain lookups with dictionaries at the
head of the chain. Also add a few tighter assertions to cached prototype lookups
to catch this in future.

File:

• trunk/JavaScriptCore/jit/JITStubs.cpp (modified) (1 diff)

trunk/JavaScriptCore/jit/JITStubs.cpp

@@ -756 +756 @@
 
         JIT::patchGetByIdSelf(codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
+        return;
+    }
+
+    if (structure->isDictionary()) {
+        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
         return;
     }